{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/msaccess.exe/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["WINWORD.EXE","EXCEL.EXE","POWERPNT.EXE","MSPUB.EXE","MSACCESS.EXE"],"_cs_severities":["medium"],"_cs_tags":["wmi","image load","office","execution"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis detection rule identifies suspicious image loading of \u003ccode\u003ewmiutils.dll\u003c/code\u003e from Microsoft Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, MSPUB.EXE, MSACCESS.EXE). Adversaries can use this technique to execute code and evade traditional parent/child processes spawned from Microsoft Office products. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUser opens a malicious Microsoft Office document (e.g., Word, Excel).\u003c/li\u003e\n\u003cli\u003eThe document contains a macro or exploit that triggers the execution of WMI commands.\u003c/li\u003e\n\u003cli\u003eThe Office application spawns a WMI process or utilizes existing WMI infrastructure.\u003c/li\u003e\n\u003cli\u003eThe WMI process loads the \u003ccode\u003ewmiutils.dll\u003c/code\u003e library, which is unusual for normal Office operations.\u003c/li\u003e\n\u003cli\u003eThe WMI commands execute malicious code, potentially downloading or executing further payloads.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes persistence through WMI event subscriptions or other methods.\u003c/li\u003e\n\u003cli\u003eThe attacker performs lateral movement using WMI to execute commands on other systems.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to execute arbitrary code, establish persistence, and move laterally within the network, potentially leading to data exfiltration, system compromise, or ransomware deployment. While the number of victims is unknown, this technique can be used in targeted attacks against organizations that heavily rely on Microsoft Office applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Suspicious WMI Image Load from MS Office\u0026rdquo; to your SIEM and tune for your environment.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon event ID 7 (Image Loaded) logging for comprehensive image load monitoring as suggested in the \u003ca href=\"https://ela.st/sysmon-event-7-setup\"\u003esetup instructions\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events for Microsoft Office applications spawning WMI-related processes (e.g., \u003ccode\u003ewbemtest.exe\u003c/code\u003e, \u003ccode\u003ewmic.exe\u003c/code\u003e) to detect potential WMI abuse.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to limit lateral movement in case of a successful WMI-based attack.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-09T12:00:00Z","date_published":"2024-01-09T12:00:00Z","id":"/briefs/2024-01-suspicious-wmi-image-load/","summary":"Adversaries may exploit Windows Management Instrumentation (WMI) to execute code stealthily, bypassing traditional security measures by loading `wmiutils.dll` from Microsoft Office applications, potentially indicating malicious execution.","title":"Suspicious WMI Image Load from MS Office","url":"https://feed.craftedsignal.io/briefs/2024-01-suspicious-wmi-image-load/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Windows","Citrix System32","MSACCESS.EXE","GTInstaller","Elastic Defend","SentinelOne Cloud Funnel","Microsoft Defender XDR","Crowdstrike FDR","Elastic Endgame"],"_cs_severities":["high"],"_cs_tags":["defense-evasion","script-execution","windows"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Citrix","Quokka.Works","Elastic","SentinelOne","Crowdstrike"],"content_html":"\u003cp\u003eThis detection identifies the execution of scripts via HTML applications, leveraging Windows utilities like \u003ccode\u003erundll32.exe\u003c/code\u003e or \u003ccode\u003emshta.exe\u003c/code\u003e. Attackers often use this method to bypass process and signature-based defenses by proxying the execution of malicious content through legitimate, signed binaries. The detection focuses on specific command-line arguments and patterns associated with this technique, while also excluding known legitimate uses by applications such as Citrix System32 (\u003ccode\u003ewfshell.exe\u003c/code\u003e), Microsoft Access (\u003ccode\u003eMSACCESS.EXE\u003c/code\u003e), and Quokka.Works (\u003ccode\u003eGTInstaller.exe\u003c/code\u003e). This technique is used by attackers to execute malicious scripts without directly running them, thus evading traditional security measures. The detection rule analyzes process names, command-line arguments, parent processes, and file paths to identify potentially malicious activity indicative of defense evasion.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access through various means (e.g., phishing, drive-by download).\u003c/li\u003e\n\u003cli\u003eThe attacker leverages a malicious HTML application (HTA) file or a scriptlet (SCT) file.\u003c/li\u003e\n\u003cli\u003eThe attacker uses \u003ccode\u003emshta.exe\u003c/code\u003e or \u003ccode\u003erundll32.exe\u003c/code\u003e to execute the malicious HTA or SCT file. The command line includes obfuscated or encoded script content.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003emshta.exe\u003c/code\u003e or \u003ccode\u003erundll32.exe\u003c/code\u003e process spawns a child process, such as \u003ccode\u003ecmd.exe\u003c/code\u003e or \u003ccode\u003epowershell.exe\u003c/code\u003e, to execute further commands.\u003c/li\u003e\n\u003cli\u003eThe spawned process executes malicious code, such as downloading and executing a payload.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves persistence by modifying registry keys or creating scheduled tasks.\u003c/li\u003e\n\u003cli\u003eThe attacker performs lateral movement by exploiting vulnerabilities or using stolen credentials.\u003c/li\u003e\n\u003cli\u003eThe final objective is achieved, such as data exfiltration, ransomware deployment, or system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to arbitrary code execution, allowing attackers to compromise the system, steal sensitive data, deploy ransomware, or establish a persistent foothold. Due to the nature of the technique, it can bypass many traditional security measures. The wide adoption of Windows and the inherent trust placed in signed binaries makes this a potent evasion technique. Failure to detect and prevent this attack can lead to significant financial and reputational damage for the targeted organization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Script Execution via Microsoft HTML Application\u0026rdquo; to your SIEM to detect suspicious \u003ccode\u003emshta.exe\u003c/code\u003e and \u003ccode\u003erundll32.exe\u003c/code\u003e executions. Tune the rule by adding exceptions for known legitimate uses in your environment.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon process creation logging (Event ID 1) to ensure the visibility required for the Sigma rules to function correctly.\u003c/li\u003e\n\u003cli\u003eMonitor process command lines for suspicious arguments like \u0026ldquo;script:eval\u0026rdquo;, \u0026ldquo;WScript.Shell\u0026rdquo;, and \u0026ldquo;mshta http\u0026rdquo; which are indicative of this technique.\u003c/li\u003e\n\u003cli\u003eImplement application control policies to restrict the execution of \u003ccode\u003emshta.exe\u003c/code\u003e and \u003ccode\u003erundll32.exe\u003c/code\u003e where they are not required for legitimate business purposes.\u003c/li\u003e\n\u003cli\u003eInvestigate and block any identified malicious HTA files or scriptlet URLs found in the command lines of detected processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T15:00:00Z","date_published":"2024-01-03T15:00:00Z","id":"/briefs/2024-01-script-execution-via-html-app/","summary":"Detects the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe to bypass defenses by proxying execution of malicious content with signed binaries.","title":"Script Execution via Microsoft HTML Application","url":"https://feed.craftedsignal.io/briefs/2024-01-script-execution-via-html-app/"}],"language":"en","title":"CraftedSignal Threat Feed — MSACCESS.EXE","version":"https://jsonfeed.org/version/1.1"}